CHAPTER 5. INTERNAL AUDIT PROGRAM.
5.1 Purpose.
This chapter provides information and describes criteria for establishing an internal audit program. This chapter may be used by PAHs and their suppliers to show compliance with § 21.137 regarding internal audits.
5.2 Background.
An internal audit program is a comprehensive, continuous monitoring process that is initiated and usually managed by top company and quality assurance (QA) management. The personnel conducting the various audits in support of the internal audit program may be internal or external to the process. The objective of this process is to promote attitudes and procedures that focus on controlling processes, rather than depending on corrections of deficiencies, to meet quality goals.
5.3 Types of Internal Audit Programs.
An internal audit program should be part of the overall quality system, be approved by top company and QA management, and have a detailed written description of the key elements of the program. Each PAH is unique regarding size, facilities, personnel, resources, and methods of operation. Therefore, different types of programs may be appropriate for individual organizations. The three basic audit programs commonly used are (1) a dedicated internal quality audit department, (2) a dedicated individual manager with part-time auditors provided from throughout the organization, and
(3) a combination of internal and external resources.
5.4 Elements of an Internal Audit Program.
An internal audit program is required by the rule to provide an adequate level of independence, a reporting process that ensures an accountable manager is aware of the audit results, and an effective corrective action process. The corrective action process should determine the root causes of deficiencies, correct these deficiencies, and prevent the recurrence of deficiencies. The program should have a structure and process designed to improve all system elements and processes that affect product quality.
The key elements of an internal audit program are as follows:
5.4.1 Audit Planning.
5.4.1.1 Audit Schedules.
Specific audit schedules should identify areas or activities subject to audit and ensure they are audited in a predetermined frequency and defined timeframe. Audit schedules should be based on the criticality of the activity being audited and should consider factors such as audit result history, production volume, process performance, high-risk areas, and management concerns.
5-1
5.4.1.2 Auditor Selection.
The internal quality audit program should specify that auditors receive training in auditing, audit principles, and systems analysis techniques.
When full-time dedicated audit resources are not practical, developed procedures should show that persons performing audits or supervising audit teams are not directly responsible for the areas being audited.
5.4.1.3 Audit Preparation.
The auditor needs to be cognizant of internal and external requirements and other factors that may impact the process.
5.4.1.4 Checklist Development.
A thorough audit program should determine and evaluate how an organization’s quality manual, operating procedures, process controls, methods, and practices account for and incorporate all internal and external requirements. The questions contained in a checklist, in effect, transpose standards, regulations, or procedural requirements into a series of questions.
The checklist denotes points to be checked and helps the auditor determine the correct order in which to proceed with an audit.
5.4.2 Conducting the Audit.
The auditor should use the audit checklist to gather evidence to determine compliance or noncompliance to the quality system or standard being evaluated. Evidence is gathered via review of products or articles, documents, observation of activities, record checks, and interviews with key individuals in the area(s) under review. Evidence gathered during the audit should be documented as the audit is conducted.
5.4.3 Reporting the Results.
A report should be prepared documenting the results of the audit. Procedures should be in place allowing straight-line reporting from the audit team to top company and QA management. The audit report should, at a minimum, include the following:
Date the audit was conducted, Auditor performing the audit, Standard or procedure the audit was conducted against (for example, part 21 requirements or the PAH Quality Manual), Summary of findings. This should include a brief description of the findings and supporting documents (for example, PAH procedures or records), Evaluation and relative importance of a finding (major or minor), and Summary of observations, both positive and negative.
5.4.4 Root Cause/Corrective and Preventive Action.
The PAH should determine root cause and develop a corrective and preventive action plan.
5-2
5.4.5 Close the Audit Findings.
After the process owner indicates completion of the corrective action, QA management should verify that process changes effectively corrected the existing deficiency and prevented recurrence. If the verification process indicates that the corrective action was not effective, top company management should be notified. QA management should then request additional corrective action and revalidation from the process owner.
5.4.6 File Report.
Audit reports, including corrective action and closure data, should be maintained.
5-3
CHAPTER 6. ADDITIONAL PAH REQUIREMENTS.
6.1 Quality Manual.
Sections 21.138, 21.308, and 21.608 state that each applicant or current PAH provide a manual describing its quality system to the FAA for approval. The manual is required by the rule to be in the English language and retrievable in a form acceptable to the FAA.
6.1.1 If the quality manual is stored digitally through a computer-based medium, it should be easily available to PAHs and FAA personnel who need to use the manual for performing their duties.
6.1.2 PAHs are reminded that the manual is required by the rule to address all of the quality system requirements in 21.137.
6.2 Location of or Change to Manufacturing Facilities.
Sections 21.139, 21.309, and 21.609 state that a PAH may obtain a production approval for manufacturing facilities located outside the United States, if the FAA finds no undue burden in administering the applicable requirements of Title 49 of the United States Code and this subchapter.
6.2.1 The PAH is required by the rule to obtain FAA approval before making any changes to the location of any of its manufacturing facilities.
6.2.2 The PAH is required by the rule to immediately notify the FAA, in writing, of any change to the manufacturing facilities affecting the inspection, conformity, or airworthiness of its product or article.
6.2.3 Each applicant for a production approval or current PAH should check with its local MIDO to determine approval and notification methods.
6.3 Inspections and Tests.
6.3.1 Sections 21.140, 21.310, and 21.610 state that each applicant or current PAH allow the FAA to— Inspect its quality system, facilities, technical data, and manufactured products or articles.
Witness any tests including any inspections or tests at any supplier facility (within the PAH’s supply chain) necessary to determine compliance with the applicable subchapter.
The PAH should ensure FAA access to, and cooperation of, all involved facilities in the supply chain. The PAH should also ensure access to, and cooperation of, all involved facilities in the supply chain for itself or its representatives.
6-1
6.3.2 Section 21.310 also prescribes prohibitions unique to that section. PAHs operating under subpart K should refer to the applicable section to ensure they are not in violation of those prohibitions.
6.4 Issuance of a Production Approval.
Sections 21.141, 21.311, and 21.611 states that the FAA issues a production approval after finding that the applicant complies with the requirements of the applicable subpart.
6.4.1 Applicants for a production approval should ensure they have reviewed and documented how they have met the applicable requirements so the FAA may complete a timely review.
6.4.2 Applicants for a production approval that are part of a multinational and/or multicorporate consortium may refer to appendix G to this AC for further guidance on how to comply with § 21.137.
6.5 Production Limitation Record.
Section 21.142, Production limitation record, states that the FAA will issue a PLR as part of a PC. A PLR lists the TC number and model of every product the PC holder is authorized to manufacture, as well as every interface component a PC holder is authorized to manufacture and install under part 21. PC holders should ensure the PLR accurately reflects any product it intends to manufacture and any interface component it intends to manufacture and install.
6.6 Duration.
6.6.1 Sections 21.143, 21.313, and 21.613 state that a production approval be considered effective until it is surrendered, suspended, revoked, or terminated by the FAA.
There are minor differences between the duration of a PC and that of a PMA or TSO authorization. Applicants receiving a production approval should refer to the applicable section for information on the duration of a particular production approval.
6.6.2 Section 21.613 also sets forth the requirements for revised or canceled TSOs. The holder of an affected FAA letter of acceptance of a statement of conformance, TSO authorization, or letter of TSO design approval, may continue to manufacture articles that meet the original TSO without obtaining a new acceptance, authorization, or approval. However, the holder is required by the rule to comply with the requirements of this chapter.
6.7 Transferability.
Sections 21.144, 21.314, and 21.614 state that a PAH may not transfer the production approval or letter of TSO design approval.
6-2
6.7.1 The FAA prohibits that transfer of a production approval, but the FAA recognizes that companies do change ownership. In many cases, design data, quality systems, and manufacturing processes are all transferred as part of the change in ownership, and in these instances the FAA will support the establishment of a new production approval.
6.7.2 Applicants for new production approvals based on previously issued production approvals should consult their local ACO and MIO for assistance.
6.8 Privileges.
Section 21.145, Privileges, identifies privileges associated with a production certificate.
PAHs should refer to the applicable section to ensure that they know these privileges.
6.9 Responsibility of Holder.
Sections 21.146, 21.316, and 21.616 prescribe a PAH’s responsibilities. PAHs should refer to the appropriate rule section for the type of production approval they wish to obtain or maintain to ensure they understand all of the applicable requirements.
6.9.1 The PAH is responsible for controlling the manufacture of completed products and articles in conformity with the FAA-approved type design data and quality system requirements. This responsibility cannot be delegated to, or relieved by, the use of approved suppliers, risk and revenue sharing partners, or co-producers.
6.9.2 Although this responsibility never changes, the PAH may be relieved of some of the burden of inspection and testing duties when it uses type-certificated products or articles manufactured under another person’s production approval. This relief may be extended to include products or articles manufactured in a foreign country and imported into the United States under the provisions of a bilateral agreement pursuant to part 21, subpart N, Approval of Engines, Propellers, Materials, Parts, and Appliances: Import.
6.9.3 All types of PAHs now have substantially similar responsibilities, as described below.
6.9.3.1 Paragraph (a) of each section requires the PAH to document any organizational changes. Such documentation is accomplished by amending the document required by §§ 21.135, 21.305, and 21.605, respectively, detailing how the organization will comply with the provisions of the respective subpart. The PAH is required by the rule to provide these amendments to the FAA. This requirement ensures the FAA remains informed of changes in a PAH’s organization as well as its continued compliance with the respective subpart.
6.9.3.2 Paragraph (b) of each section requires a PAH to maintain its quality system in compliance with the data and procedures approved for its production approval.
6-3
6.9.3.3 Paragraph (c) of each section requires a PAH to ensure each product or article conforms to its approved design and is in a condition for safe operation.
6.9.3.4 Paragraph (d) of each section requires a PAH to mark its product or article in accordance with part 45, including critical parts.
6.9.3.5 Paragraph (e) of each section requires a PAH to identify any parts of the product or article that leave the manufacturer’s facility as FAA-approved.
This includes the manufacturer’s part number and name, trademark, symbol, or other FAA-approved PAH identification. (Examples of other FAA-approved PAH identification are production approval number, cage code, or a federal supply code for manufacturers (FSCM).) The information may be conveyed in the form of stickers, tags, shipping documents, shipping containers, or by other means. This information may also be applied directly to the subassemblies or component parts in accordance with approved data.
6.9.3.6 Paragraph (f) of each section requires a PAH to have access to type design data necessary to determine conformity and airworthiness for each product and article produced under its production approval. TSO authorization holders have the additional requirement of retaining this data until they no longer manufacture the article. At that time, copies of the data are required by the rule to be sent to the FAA.
6.9.3.7 Paragraph (g) of each section requires a PAH to retain the document(s) granting production approval and make it available to the FAA on request.
6.9.3.8 Paragraph (h) of each section requires a PAH to make available to the FAA information regarding all delegation of authority to suppliers. This includes delegations for the purpose of performing major inspections, delegations related to direct ship authorization, and delegations related to the disposition of nonconforming material.
6.10 Amendment of Production Certificates.
Section 21.147, Amendment of production certificates, requires:
6.10.1 Any applicant for an amendment to a PC seeking to add a type certificate, model, or both must comply with §§ 21.137, 21.138, and 21.150.
6.10.2 Any applicant for an amendment to a PC, under § 21.147, must apply in a form and manner prescribed by the FAA. Currently, the FAA expects an applicant to submit a properly executed FAA Form 8110-12, Application For Type Certificate, Production Certificate, Or Supplemental Type Certificate. Any application for an interface component should clearly note that in block 5.a.
6-4
6.10.3 Under §21.147(c), any applicant may apply to amend its PLR to allow the manufacture and installation of an interface component, provided— The applicant owns or has a license to use the design and installation data for the interface component, and makes that data available to the FAA on request.
The interface component is manufactured by the applicant.
The applicant’s product conforms to its approved type design, and the interface component conforms to its approved type design.
The assembled product with the installed interface component is in a condition for safe operation unless otherwise noted.
The applicant complies with any other conditions and limitations the FAA considers necessary.
6.11 Approval for Deviation.
Section 21.618, Approval for deviation, requires a manufacturer requesting approval to deviate from a performance standard of a TSO to show that factors or design features provide an equivalent level of safety and compensate for the standards from which a deviation is requested. The manufacturer will send requests for approval to deviate to the appropriate ACO, along with all pertinent data. If the article is manufactured under the authority of a foreign country or jurisdiction, the manufacturer will send requests for approval to deviate, along with all pertinent data, through the CAA of that country or jurisdiction to the FAA.
6.12 Design Changes.
Sections 21.319 and 21.619 prescribe what constitutes a major or minor design change, as well as who may make those changes. Minor changes will be approved under a method acceptable to the FAA. Major changes are required by the rule to be approved by the FAA before they can be included in the design of the product or article. PAHs that are uncertain if a design change is major or minor should consult with the FAA before implementing the changes.
6.13 Changes in Quality System.
Sections 21.150, 21.320, and 21.620 establish that each change to the quality system is subject to FAA review. Additionally, the PAH is required by the rule to immediately notify the FAA, in writing, of any change that may affect the inspection, conformity, or airworthiness of its product or article. PAHs that wish to initiate changes to the quality system should submit the proposed changes to the MIO, MIDO, or Manufacturing Inspection Satellite Office (MISO) with certificate management responsibilities.
6-5
6.14 Issuance of Letters of TSO Design Approval: Import Articles.
Section 21.621, Issue of letters of TSO design approval: Import articles, prescribes under what conditions a letter of TSO design approval may be issued for imported articles.
6-6
Appendix A APPENDIX A. RELATED PUBLICATIONS.
A.1 Federal Aviation Administration (FAA) Orders.
FAA Order 8000.95, Designee Management Policy.
FAA Order 8100.8, Designee Management Handbook.
FAA Order 8100.11, Decision Paper Requirements for Undue Burden and No Undue Burden Determinations Under 14 CFR part 21 for Production and Export Airworthiness Approvals.
FAA Order 8100.15, Organization Designation Authorization Procedures.
FAA Order 8110.4, Type Certification.
FAA Order 8110.42, Parts Manufacturer Approval Procedures.
FAA Order 8120.22, Production Approval Procedures.
FAA Order 8120.23, Certificate Management of Production Approval Holders.
FAA Order 8120.12, Production Approval Holder Use Of Other-Parties To Supplement Their Supplier Control Program.
FAA Order 8120.13, International Cooperative Supplier Surveillance Program Procedures.
FAA Order 8130.21, Procedures for Completion and Use of the Authorized Release Certificate, FAA Form 8130-3, Airworthiness Approval Tag.
A.2 FAA Advisory Circulars (AC).
AC 20-115, Airborne Software Assurance.
AC 21-2, Complying with the Requirements of Importing Countries or Jurisdictions when Exporting U.S. Products, Articles, or Parts.
AC 21-18, Bilateral Airworthiness Agreements.
AC 21-23, Airworthiness Certification of Civil Aircraft, Engines, Propellers, and Related Products Imported to the United States.
AC 21-24, Extending a Production Certificate to a Facility Located in a Bilateral Airworthiness Agreement Country.
AC 21-44, Issuance of Export Airworthiness Approvals Under 14 CFR Part 21 Subpart L.
A-1
Appendix A A.3 Society of Automotive Engineers (SAE) Documents.
Copies may be purchased from the SAE.
SAE Aerospace Recommended Practice (ARP) 9005, Aerospace Guidance for Non-Deliverable Software.
SAE ARP9013, Statistical Product Acceptance Requirements.
SAE ARP9013/1, Statistical Product Acceptance Requirements Using Isolated Lot Sampling Methods.
SAE ARP9013/2, Statistical Product Acceptance Requirements Using Attribute or Variable Lot Acceptance Sampling Plans.
SAE ARP9013/3, Statistical Product Acceptance Requirements Using Process Control Methods.
SAE ARP9013/4, Statistical Product Acceptance Requirements Using Continuous Sampling, Skip-Lot Sampling, or Methods for Special Cases.
SAE ARP9114, Direct Ship Guidance for Aerospace Companies.
SAE ARP9134, Supply Chain Risk Management Guidelines.
SAE Aerospace Standard (AS) 9006, Deliverable Aerospace Software Supplement for AS9100A.
SAE AS9100C, Quality Management Systems - Aerospace Requirements.
SAE AS9102A, Aerospace First Article Inspection Requirement.
A.4 Other Documents.
National Aerospace Standard (NAS) 410, NAS Certification and Qualification of Nondestructive Test Personnel.
Industrial Fasteners Institute Standard IFI-301, Gage Calibration Requirements and Procedures for Thread Gages.
A-2
Appendix B APPENDIX B. DEFINITIONS.
For the purposes of this document, the following definitions apply.
B.1 Accountable Manager.
A representative of the applicant for, or holder of, a production approval. An accountable manager serves as a PAH’s primary contact with the FAA office responsible for issuance of the production approval or certificate management of the PAH. The accountable manager is responsible within the applicant’s or PAH’s organization for, and has the authority over, all production operations conducted pursuant to 14 CFR part 21, Certification Procedures for Products and Articles. The accountable manager confirms that the procedures described in the quality manual required by §§ 21.138, 21.308, or 21.608 are in place and that the production approval holder satisfies the requirements of subchapter C, Aircraft.
B.2 Airworthiness Approval.
A document issued by the FAA for an aircraft, aircraft engine, propeller, or article that certifies the aircraft, aircraft engine, propeller, or article conforms to its approved design and is in a condition for safe operation, unless otherwise specified.
B.3 Applicable Design Data.
All necessary drawings, specifications, and other technical information provided by the applicant for, or the holder of, a design organization approval, TC, STC, TSO authorization, PMA, or equivalent, and released in a controlled manner for production purposes.
B.4 Approved.
Unless used with reference to another person, means approved by the FAA or any person to whom the FAA has delegated its authority in the matter concerned, or approved under the provisions of a bilateral agreement between the United States and = a foreign country or jurisdiction.
B.5 Approved Design Data.
Applicable design data that has been granted an approval (for example, TC, STC, TSO authorization, PMA, or equivalent) by the relevant CAA.
B.6 Article.
A material, part, component, process, or appliance.
B-1